mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Verify Content-Type from smart HTTP servers

Browse Source 
Before parsing a suspected smart-HTTP response verify the returned
Content-Type matches the standard. This protects a client from
attempting to process a payload that smells like a smart-HTTP
server response.

JGit has been doing this check on all responses since the dawn of
time. I mistakenly failed to include it in git-core when smart HTTP
was introduced. At the time I didn't know how to get the Content-Type
from libcurl. I punted, meant to circle back and fix this, and just
plain forgot about it.

Signed-off-by: Shawn Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Shawn Pearce
2013-01-31 13:02:07 -08:00
committed by Junio C Hamano
parent e1b6ff44d6
commit 4656bf47fc
8 changed files with 59 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
t/t5551-http-fetch.sh
View File

@ -157,6 +157,12 @@ test_expect_success 'GIT_SMART_HTTP can disable smart http' '
test_must_fail git fetch)
'
test_expect_success 'invalid Content-Type rejected' '
echo "fatal: invalid content-type text/html" >expect
test_must_fail git clone $HTTPD_URL/broken_smart/repo.git 2>actual
test_cmp expect actual
'
test -n "$GIT_TEST_LONG" && test_set_prereq EXPENSIVE
test_expect_success EXPENSIVE 'create 50,000 tags in the repo' '